Updated | Bartolo, PN demand privacy probe on student profile powers

Education minister Evarist Bartolo has asked the new Commissioner for Information and Data Protection, Saviour Cachia, to review the legal notice which enables the minister to collect data on students.

Stressing that the previous data protection commission had “consulted” the office at all stages before the legal notice was issued, Bartolo nonetheless asked Cachia to “work hand in hand with your office in order to be guided to ensure protection of the data subjects.”
The opposition this week saw its motion in parliament to have the legal notice annulled defeated. However, the PN insisted that the legal notice gave the minister “excessive powers” and breached children’s privacy rights.

In his letter to Cachia, the minister acknowledged that he would like to “address these genuine concerns” and asked the commissioner to review the legal notice and provide his feedback.

In the letter, Bartolo said the ministry’s sole aim was that of helping “vulnerable children and to facilitate the transition from education to employment.”

The former data protection commissioner Joseph Ebejer has denied that his office approved granting the minister the right to access personal data, despite emails tabled in Parliament this week showed that his office had informed the ministry in December that it "went through the legal notice and agrees with the content as drafted."

The Nationalist Party has also filed its request with the IDPC to investigate the legal notice, which it describes as "disproportionate in scope and aim" and that it does not protect students and their parents from an abuse of power.

The PN said the rules were published at a time when the IDPC was not yet appointed. "It is surreal that the minister is aksing for the help of the IDPC when a few days ago, he said the legal notice had already been approved by the previous commissioner, something that has not been confirmed by the latter."

Timeline

In a second statement issued today, the ministry said that “in light of inaccurate news reports by sections of the media” on the legal notice the ministry “would like to clarify things by producing the timeline of events as they happened.”

The ministry said that talks with the data protection office commenced on 18 September 2013 when it requested advice on how to proceed with transferring students' data for Jobs + initiatives and to provide the best possible service to students.

A meeting between ministry officials and IDPC office took place on 23 October and former commissioner Joseph Ebejer “advised that a legal notice be enacted in order to enable the transfer of such data.”

The first draft of the legal notice was sent to the commissioner on 12 November and on 19 December a officer from the commissioner’s office sent an email to ministry officials tracking changes to the legal notice draft.

“Specific reference is made by the IDPC to a typo in the word 'Minister', in a communication that Mr Ebejer was copied in, proving that the Ministerial part of the legal notice was not only noted, but scrutinised by the IDPC and Mr Ebejer,” the statement said.

In January 2014 a reminder was sent with minor changes for approval by the ministry to the commissioner and the following day the IDPC replied and reiterated to retain the draft as approved on the 19 December.

Data Commissioner Joseph Ebejer was also copied in this exchange. His office replied that they had no issue with one of the minor changes, namely the title of the legal notice. The IDPC also suggested a removal of part of the legal notice, to which the Ministry agreed.

On 27 January the ministry sent the final draft of the legal notice and requested advice as to whether the legal notice would enable the ministry to obtain ID cards numbers of students.

“This was followed by a telephone conversation on the same day, wherein advice was given by an IDPC official that the legal notice would need to be amended with specific reference being made to the ID card numbers since without such specific reference ID numbers could not be transferred.”

The ministry added that on that same day, its officials amended the legal notice and a draft was sent to IDPC. Two days later IDPC sent final approval with respect to the proposed legal notice with Ebejer being copied in once again.